October 2009 - Wine-Commits

Juan Lang : crypt32: Implement CertVerifyCertificateChainPolicy for CERT_CHAIN_POLICY_SSL.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: 9059892ec1da79567279aaeb96f46791718bc7a1 URL: http://source.winehq.org/git/wine.git/?a=commit;h=9059892ec1da79567279aaeb9… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Oct 28 09:17:30 2009 -0700 crypt32: Implement CertVerifyCertificateChainPolicy for CERT_CHAIN_POLICY_SSL. --- dlls/crypt32/chain.c | 231 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 231 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index e8f9de3..8972463 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -2117,6 +2117,234 @@ static BOOL WINAPI verify_basic_constraints_policy(LPCSTR szPolicyOID, return TRUE; } +static inline PCERT_EXTENSION get_subject_alt_name_ext(PCCERT_CONTEXT cert) +{ + PCERT_EXTENSION ext; + + ext = CertFindExtension(szOID_SUBJECT_ALT_NAME2, + cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension); + if (!ext) + ext = CertFindExtension(szOID_SUBJECT_ALT_NAME, + cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension); + return ext; +} + +static BOOL match_dns_to_subject_alt_name(PCERT_EXTENSION ext, + LPCWSTR server_name) +{ + BOOL matches = FALSE; + CERT_ALT_NAME_INFO *subjectName; + DWORD size; + + TRACE_(chain)("%s\n", debugstr_w(server_name)); + /* FIXME: This can be spoofed by the embedded NULL vulnerability. The + * returned CERT_ALT_NAME_INFO doesn't have a way to indicate the + * encoded length of a name, so a certificate issued to + * winehq.org\0badsite.com will get treated as having been issued to + * winehq.org. + */ + if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ALTERNATE_NAME, + ext->Value.pbData, ext->Value.cbData, + CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL, + &subjectName, &size)) + { + DWORD i; + BOOL found = FALSE; + + for (i = 0; !found && i < subjectName->cAltEntry; i++) + { + if (subjectName->rgAltEntry[i].dwAltNameChoice == + CERT_ALT_NAME_DNS_NAME) + { + TRACE_(chain)("dNSName: %s\n", debugstr_w( + subjectName->rgAltEntry[i].u.pwszDNSName)); + found = TRUE; + if (!strcmpiW(server_name, + subjectName->rgAltEntry[i].u.pwszDNSName)) + matches = TRUE; + } + } + LocalFree(subjectName); + } + return matches; +} + +static BOOL find_matching_domain_component(CERT_NAME_INFO *name, + LPCWSTR component) +{ + BOOL matches = FALSE; + DWORD i, j; + + for (i = 0; !matches && i < name->cRDN; i++) + for (j = 0; j < name->rgRDN[i].cRDNAttr; j++) + if (!strcmp(szOID_DOMAIN_COMPONENT, + name->rgRDN[i].rgRDNAttr[j].pszObjId)) + { + PCERT_RDN_ATTR attr; + + attr = &name->rgRDN[i].rgRDNAttr[j]; + /* Compare with memicmpW rather than strcmpiW in order to avoid + * a match with a string with an embedded NULL. The component + * must match one domain component attribute's entire string + * value with a case-insensitive match. + */ + matches = !memicmpW(component, (LPWSTR)attr->Value.pbData, + attr->Value.cbData / sizeof(WCHAR)); + } + return matches; +} + +static BOOL match_dns_to_subject_dn(PCCERT_CONTEXT cert, LPCWSTR server_name) +{ + BOOL matches = FALSE; + CERT_NAME_INFO *name; + DWORD size; + + TRACE_(chain)("%s\n", debugstr_w(server_name)); + if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_UNICODE_NAME, + cert->pCertInfo->Subject.pbData, cert->pCertInfo->Subject.cbData, + CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL, + &name, &size)) + { + /* If the subject distinguished name contains any name components, + * make sure all of them are present. + */ + if (CertFindRDNAttr(szOID_DOMAIN_COMPONENT, name)) + { + LPCWSTR ptr = server_name; + + matches = TRUE; + do { + LPCWSTR dot = strchrW(ptr, '.'), end; + /* 254 is the maximum DNS label length, see RFC 1035 */ + WCHAR component[255]; + DWORD len; + + end = dot ? dot : ptr + strlenW(ptr); + len = end - ptr; + if (len >= sizeof(component) / sizeof(component[0])) + { + WARN_(chain)("domain component %s too long\n", + debugstr_wn(ptr, len)); + matches = FALSE; + } + else + { + memcpy(component, ptr, len * sizeof(WCHAR)); + component[len] = 0; + matches = find_matching_domain_component(name, component); + } + ptr = dot ? dot + 1 : end; + } while (matches && ptr && *ptr); + } + else + { + PCERT_RDN_ATTR attr; + + /* If the certificate isn't using a DN attribute in the name, make + * make sure the common name matches. Again, use memicmpW rather + * than strcmpiW in order to avoid being fooled by an embedded NULL. + */ + if ((attr = CertFindRDNAttr(szOID_COMMON_NAME, name))) + { + TRACE_(chain)("CN = %s\n", debugstr_w( + (LPWSTR)attr->Value.pbData)); + matches = !memicmpW(server_name, (LPWSTR)attr->Value.pbData, + attr->Value.cbData / sizeof(WCHAR)); + } + } + LocalFree(name); + } + return matches; +} + +static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID, + PCCERT_CHAIN_CONTEXT pChainContext, PCERT_CHAIN_POLICY_PARA pPolicyPara, + PCERT_CHAIN_POLICY_STATUS pPolicyStatus) +{ + pPolicyStatus->lChainIndex = pPolicyStatus->lElementIndex = -1; + if (pChainContext->TrustStatus.dwErrorStatus & + CERT_TRUST_IS_NOT_SIGNATURE_VALID) + { + pPolicyStatus->dwError = TRUST_E_CERT_SIGNATURE; + find_element_with_error(pChainContext, + CERT_TRUST_IS_NOT_SIGNATURE_VALID, &pPolicyStatus->lChainIndex, + &pPolicyStatus->lElementIndex); + } + else if (pChainContext->TrustStatus.dwErrorStatus & + CERT_TRUST_IS_UNTRUSTED_ROOT) + { + pPolicyStatus->dwError = CERT_E_UNTRUSTEDROOT; + find_element_with_error(pChainContext, + CERT_TRUST_IS_UNTRUSTED_ROOT, &pPolicyStatus->lChainIndex, + &pPolicyStatus->lElementIndex); + } + else if (pChainContext->TrustStatus.dwErrorStatus & CERT_TRUST_IS_CYCLIC) + { + pPolicyStatus->dwError = CERT_E_UNTRUSTEDROOT; + find_element_with_error(pChainContext, + CERT_TRUST_IS_CYCLIC, &pPolicyStatus->lChainIndex, + &pPolicyStatus->lElementIndex); + /* For a cyclic chain, which element is a cycle isn't meaningful */ + pPolicyStatus->lElementIndex = -1; + } + else if (pChainContext->TrustStatus.dwErrorStatus & + CERT_TRUST_IS_NOT_TIME_VALID) + { + pPolicyStatus->dwError = CERT_E_EXPIRED; + find_element_with_error(pChainContext, + CERT_TRUST_IS_NOT_TIME_VALID, &pPolicyStatus->lChainIndex, + &pPolicyStatus->lElementIndex); + } + else + pPolicyStatus->dwError = NO_ERROR; + /* We only need bother checking whether the name in the end certificate + * matches if the chain is otherwise okay. + */ + if (!pPolicyStatus->dwError && pPolicyPara && + pPolicyPara->cbSize >= sizeof(CERT_CHAIN_POLICY_PARA)) + { + HTTPSPolicyCallbackData *sslPara = pPolicyPara->pvExtraPolicyPara; + + if (sslPara && sslPara->u.cbSize >= sizeof(HTTPSPolicyCallbackData)) + { + if (sslPara->dwAuthType == AUTHTYPE_SERVER && + sslPara->pwszServerName) + { + PCCERT_CONTEXT cert; + PCERT_EXTENSION altNameExt; + BOOL matches; + + cert = pChainContext->rgpChain[0]->rgpElement[0]->pCertContext; + altNameExt = get_subject_alt_name_ext(cert); + /* If the alternate name extension exists, the name it contains + * is bound to the certificate, so make sure the name matches + * it. Otherwise, look for the server name in the subject + * distinguished name. RFC5280, section 4.2.1.6: + * "Whenever such identities are to be bound into a + * certificate, the subject alternative name (or issuer + * alternative name) extension MUST be used; however, a DNS + * name MAY also be represented in the subject field using the + * domainComponent attribute." + */ + if (altNameExt) + matches = match_dns_to_subject_alt_name(altNameExt, + sslPara->pwszServerName); + else + matches = match_dns_to_subject_dn(cert, + sslPara->pwszServerName); + if (!matches) + { + pPolicyStatus->dwError = CERT_E_CN_NO_MATCH; + pPolicyStatus->lChainIndex = 0; + pPolicyStatus->lElementIndex = 0; + } + } + } + } + return TRUE; +} + static BYTE msPubKey1[] = { 0x30,0x82,0x01,0x0a,0x02,0x82,0x01,0x01,0x00,0xdf,0x08,0xba,0xe3,0x3f,0x6e, 0x64,0x9b,0xf5,0x89,0xaf,0x28,0x96,0x4a,0x07,0x8f,0x1b,0x2e,0x8b,0x3e,0x1d, @@ -2257,6 +2485,9 @@ BOOL WINAPI CertVerifyCertificateChainPolicy(LPCSTR szPolicyOID, case LOWORD(CERT_CHAIN_POLICY_AUTHENTICODE): verifyPolicy = verify_authenticode_policy; break; + case LOWORD(CERT_CHAIN_POLICY_SSL): + verifyPolicy = verify_ssl_policy; + break; case LOWORD(CERT_CHAIN_POLICY_BASIC_CONSTRAINTS): verifyPolicy = verify_basic_constraints_policy; break;

1 0

Juan Lang : crypt32: Add some tests of the SSL policy.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: 2fbb736e010067b017368aac85dc34e1766347cb URL: http://source.winehq.org/git/wine.git/?a=commit;h=2fbb736e010067b017368aac8… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Oct 28 09:10:29 2009 -0700 crypt32: Add some tests of the SSL policy. --- dlls/crypt32/tests/chain.c | 136 ++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 136 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index ddc9ac5..10cea4d 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -1973,6 +1973,8 @@ static ChainCheck chainCheckNoStore[] = { /* Wednesday, Oct 1, 2007 */ static SYSTEMTIME oct2007 = { 2007, 10, 1, 1, 0, 0, 0, 0 }; +/* Wednesday, Oct 28, 2009 */ +static SYSTEMTIME oct2009 = { 2009, 10, 3, 28, 0, 0, 0, 0 }; static void testGetCertChain(void) { @@ -2139,6 +2141,52 @@ static const ChainPolicyCheck basePolicyCheck[] = { { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 }, }; +static const ChainPolicyCheck sslPolicyCheck[] = { + { { sizeof(chain0) / sizeof(chain0[0]), chain0 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain1) / sizeof(chain1[0]), chain1 }, + { 0, TRUST_E_CERT_SIGNATURE, 0, 0, NULL }, NULL, 0 }, + { { sizeof(chain2) / sizeof(chain2[0]), chain2 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain3) / sizeof(chain3[0]), chain3 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain4) / sizeof(chain4[0]), chain4 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 }, + { { sizeof(chain5) / sizeof(chain5[0]), chain5 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain6) / sizeof(chain6[0]), chain6 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain7) / sizeof(chain7[0]), chain7 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain8) / sizeof(chain8[0]), chain8 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 }, + { { sizeof(chain9) / sizeof(chain9[0]), chain9 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, -1, NULL }, NULL, 0 }, + { { sizeof(chain10) / sizeof(chain10[0]), chain10 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain11) / sizeof(chain11[0]), chain11 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain12) / sizeof(chain12[0]), chain12 }, + { 0, TRUST_E_CERT_SIGNATURE, 0, 1, NULL }, NULL, 0 }, + { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 }, +}; + +static const ChainPolicyCheck sslPolicyCheckWithMatchingNameExpired = { + { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, + { 0, CERT_E_EXPIRED, 0, 0, NULL}, NULL, 0 +}; + +static const ChainPolicyCheck sslPolicyCheckWithMatchingName = { + { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, + { 0, 0, -1, -1, NULL}, NULL, 0 +}; + +static const ChainPolicyCheck sslPolicyCheckWithoutMatchingName = { + { sizeof(iTunesChain) / sizeof(iTunesChain[0]), iTunesChain }, + { 0, CERT_E_CN_NO_MATCH, 0, 0, NULL}, NULL, 0 +}; + static const ChainPolicyCheck authenticodePolicyCheck[] = { { { sizeof(chain0) / sizeof(chain0[0]), chain0 }, { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, @@ -2312,6 +2360,93 @@ static void checkChainPolicyStatus(LPCSTR policy, const ChainPolicyCheck *check, } } +static void check_ssl_policy(void) +{ + DWORD i; + CERT_CHAIN_POLICY_PARA policyPara = { 0 }; + SSL_EXTRA_CERT_CHAIN_POLICY_PARA sslPolicyPara = { { 0 } }; + WCHAR winehq[] = { 'w','i','n','e','h','q','.','o','r','g',0 }; + WCHAR google_dot_com[] = { 'w','w','w','.','g','o','o','g','l','e','.', + 'c','o','m',0 }; + + /* Check ssl policy with no parameter */ + for (i = 0; + i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++) + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i, + &oct2007, NULL); + /* Check again with a policy parameter that specifies nothing */ + for (i = 0; + i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++) + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i, + &oct2007, &policyPara); + /* Check yet again, but specify an empty SSL_EXTRA_CERT_CHAIN_POLICY_PARA + * argument. + */ + policyPara.pvExtraPolicyPara = &sslPolicyPara; + for (i = 0; + i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++) + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i, + &oct2007, &policyPara); + /* And again, but specify the auth type as a client */ + sslPolicyPara.dwAuthType = AUTHTYPE_CLIENT; + for (i = 0; + i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++) + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i, + &oct2007, &policyPara); + /* And again, but specify the auth type as a server */ + sslPolicyPara.dwAuthType = AUTHTYPE_SERVER; + for (i = 0; + i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++) + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i, + &oct2007, &policyPara); + /* And again authenticating a client, but specify the size of the policy + * parameter. + */ + sslPolicyPara.cbSize = sizeof(sslPolicyCheck); + sslPolicyPara.dwAuthType = AUTHTYPE_CLIENT; + for (i = 0; + i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++) + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i, + &oct2007, &policyPara); + /* One more time authenticating a client, but specify winehq.org as the + * server name. + */ + sslPolicyPara.pwszServerName = winehq; + for (i = 0; + i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++) + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i, + &oct2007, &policyPara); + /* And again authenticating a server, still specifying winehq.org as the + * server name. + */ + sslPolicyPara.dwAuthType = AUTHTYPE_SERVER; + for (i = 0; + i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++) + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i, + &oct2007, &policyPara); + /* And again authenticating a server, this time specifying the size of the + * policy param. + */ + policyPara.cbSize = sizeof(policyPara); + for (i = 0; + i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++) + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i, + &oct2007, &policyPara); + /* Yet again, but checking the iTunes chain, which contains a name + * extension. + */ + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, + &sslPolicyCheckWithoutMatchingName, 0, &oct2007, &policyPara); + /* And again, but checking the Google chain at a bad date */ + sslPolicyPara.pwszServerName = google_dot_com; + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, + &sslPolicyCheckWithMatchingNameExpired, 0, &oct2007, &policyPara); + /* And again, but checking the Google chain at a good date */ + sslPolicyPara.pwszServerName = google_dot_com; + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, + &sslPolicyCheckWithMatchingName, 0, &oct2009, &policyPara); +} + static void testVerifyCertChainPolicy(void) { BOOL ret; @@ -2378,6 +2513,7 @@ static void testVerifyCertChainPolicy(void) i < sizeof(basePolicyCheck) / sizeof(basePolicyCheck[0]); i++) checkChainPolicyStatus(CERT_CHAIN_POLICY_BASE, &basePolicyCheck[i], i, &oct2007, NULL); + check_ssl_policy(); /* The authenticode policy doesn't seem to check anything beyond the base * policy. It might check for chains signed by the MS test cert, but none * of these chains is.

1 0

Juan Lang : crypt32: Correct a prototype.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: 1a194449ccb033b35bc9a62fc719aa73dee5f722 URL: http://source.winehq.org/git/wine.git/?a=commit;h=1a194449ccb033b35bc9a62fc… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Oct 23 13:51:02 2009 -0700 crypt32: Correct a prototype. --- dlls/crypt32/crypt32_private.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/dlls/crypt32/crypt32_private.h b/dlls/crypt32/crypt32_private.h index a5759a2..5e5b540 100644 --- a/dlls/crypt32/crypt32_private.h +++ b/dlls/crypt32/crypt32_private.h @@ -295,7 +295,7 @@ void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info); */ DWORD cert_name_to_str_with_indent(DWORD dwCertEncodingType, DWORD indent, - PCERT_NAME_BLOB pName, DWORD dwStrType, LPWSTR psz, DWORD csz); + const CERT_NAME_BLOB *pName, DWORD dwStrType, LPWSTR psz, DWORD csz); /** * Context functions

1 0

Juan Lang : crypt32: Accept either the subject alt name 2 or subject alt name extensions, and prefer the former when both are present.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: 6a575d697e3fcfc4ec6a2deae1b9d20bcb2aaadb URL: http://source.winehq.org/git/wine.git/?a=commit;h=6a575d697e3fcfc4ec6a2deae… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Oct 23 11:54:05 2009 -0700 crypt32: Accept either the subject alt name 2 or subject alt name extensions, and prefer the former when both are present. --- dlls/crypt32/chain.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 547c74c..160bcec 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -618,8 +618,12 @@ static void CRYPT_CheckNameConstraints( { CERT_EXTENSION *ext; - if ((ext = CertFindExtension(szOID_SUBJECT_ALT_NAME, cert->cExtension, - cert->rgExtension))) + ext = CertFindExtension(szOID_SUBJECT_ALT_NAME2, cert->cExtension, + cert->rgExtension); + if (!ext) + ext = CertFindExtension(szOID_SUBJECT_ALT_NAME, cert->cExtension, + cert->rgExtension); + if (ext) { CERT_ALT_NAME_INFO *subjectName; DWORD size; @@ -1088,6 +1092,8 @@ static BOOL CRYPT_CriticalExtensionsSupported(PCCERT_CONTEXT cert) ret = TRUE; else if (!strcmp(oid, szOID_SUBJECT_ALT_NAME)) ret = TRUE; + else if (!strcmp(oid, szOID_SUBJECT_ALT_NAME2)) + ret = TRUE; else { FIXME("unsupported critical extension %s\n",

1 0

Alexandre Julliard : kernel32/tests: Add some tests for width and precision formatting in FormatMessage.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: 549116bd68a806d924a6d08811be9badf8e123d3 URL: http://source.winehq.org/git/wine.git/?a=commit;h=549116bd68a806d924a6d0881… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Thu Oct 29 13:06:12 2009 +0100 kernel32/tests: Add some tests for width and precision formatting in FormatMessage. --- dlls/kernel32/format_msg.c | 5 +- dlls/kernel32/tests/format_msg.c | 86 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 88 insertions(+), 3 deletions(-) diff --git a/dlls/kernel32/format_msg.c b/dlls/kernel32/format_msg.c index e8f9fbc..7145479 100644 --- a/dlls/kernel32/format_msg.c +++ b/dlls/kernel32/format_msg.c @@ -493,10 +493,9 @@ DWORD WINAPI FormatMessageW( /* possible invalid pointers */ xarr[1]=*(argliststart+1); xarr[2]=*(argliststart+2); - sprintfbuf=HeapAlloc(GetProcessHeap(),0,(strlenW((LPWSTR)argliststart[0])*2+1)*sizeof(WCHAR)); - + sprintfbuf = HeapAlloc(GetProcessHeap(), 0, 1000); /* CMF - This makes a BIG assumption about va_list */ - vsprintfW(sprintfbuf, fmtstr, (va_list) xarr); + vsnprintfW(sprintfbuf, 1000, fmtstr, (va_list) xarr); } else if (strcmpW(fmtstr, fmt_wc) == 0) { sprintfbuf = HeapAlloc(GetProcessHeap(), 0, sizeof(WCHAR) * 2); diff --git a/dlls/kernel32/tests/format_msg.c b/dlls/kernel32/tests/format_msg.c index 7019321..09a0a4a 100644 --- a/dlls/kernel32/tests/format_msg.c +++ b/dlls/kernel32/tests/format_msg.c @@ -87,6 +87,14 @@ static void test_message_from_string_wide(void) static const WCHAR fmt_hi_crlf[] = {'h','i','\r','\n',0}; static const WCHAR fmt_cr[] = {'\r',0}; static const WCHAR fmt_crcrlf[] = {'\r','\r','\n',0}; + static const WCHAR fmt_13s[] = {'%','1','!','3','s','!',0}; + static const WCHAR fmt_1os[] = {'%','1','!','*','s','!',0}; + static const WCHAR fmt_142u[] = {'%','1','!','4','.','2','u','!',0}; + static const WCHAR fmt_1oou[] = {'%','1','!','*','.','*','u','!',0}; + static const WCHAR fmt_1oou1oou[] = {'%','1','!','*','.','*','u','!',',','%','1','!','*','.','*','u','!',0}; + static const WCHAR fmt_1oou3oou[] = {'%','1','!','*','.','*','u','!',',','%','3','!','*','.','*','u','!',0}; + static const WCHAR fmt_1oou4oou[] = {'%','1','!','*','.','*','u','!',',','%','4','!','*','.','*','u','!',0}; + static const WCHAR s_123d[] = {'1','2','3',0}; static const WCHAR s_14d[] = {' ',' ',' ','1',0}; static const WCHAR s_14x[] = {' ',' ',' ','b',0}; @@ -105,6 +113,14 @@ static void test_message_from_string_wide(void) static const WCHAR s_hi_sp[] = {'h','i',' ',0}; static const WCHAR s_sp[] = {' ',0}; static const WCHAR s_2sp[] = {' ',' ',0}; + static const WCHAR s_spt[] = {' ',' ','t',0}; + static const WCHAR s_sp3t[] = {' ',' ',' ','t',0}; + static const WCHAR s_sp03[] = {' ',' ','0','3',0}; + static const WCHAR s_sp001[] = {' ',' ','0','0','1',0}; + static const WCHAR s_sp001002[] = {' ',' ','0','0','1',',',' ','0','0','0','2',0}; + static const WCHAR s_sp001sp002[] = {' ',' ','0','0','1',',',' ',' ','0','0','0','2',0}; + static const WCHAR s_sp002sp001[] = {' ',' ','0','0','0','2',',',' ',' ','0','0','1',0}; + WCHAR out[0x100] = {0}; DWORD r, error; @@ -296,6 +312,41 @@ static void test_message_from_string_wide(void) ok(!lstrcmpW(s_crlfcrlf, out), "failed out=%s\n", wine_dbgstr_w(out)); ok(r==4,"failed: r=%d\n", r); + /* precision and width */ + + r = doitW(FORMAT_MESSAGE_FROM_STRING, fmt_13s, + 0, 0, out, sizeof(out)/sizeof(WCHAR), t ); + ok(!lstrcmpW(s_spt, out),"failed out=[%s]\n", wine_dbgstr_w(out)); + ok(r==3, "failed: r=%d\n",r); + r = doitW(FORMAT_MESSAGE_FROM_STRING, fmt_1os, + 0, 0, out, sizeof(out)/sizeof(WCHAR), 4, t ); + ok(!lstrcmpW( s_sp3t, out),"failed out=[%s]\n", wine_dbgstr_w(out)); + ok(r==4,"failed: r=%d\n",r); + r = doitW(FORMAT_MESSAGE_FROM_STRING, fmt_142u, + 0, 0, out, sizeof(out)/sizeof(WCHAR), 3 ); + ok(!lstrcmpW( s_sp03, out),"failed out=[%s]\n", wine_dbgstr_w(out)); + ok(r==4,"failed: r=%d\n",r); + r = doitW(FORMAT_MESSAGE_FROM_STRING, fmt_1oou, + 0, 0, out, sizeof(out)/sizeof(WCHAR), 5, 3, 1 ); + ok(!lstrcmpW( s_sp001, out),"failed out=[%s]\n", wine_dbgstr_w(out)); + ok(r==5,"failed: r=%d\n",r); + r = doitW(FORMAT_MESSAGE_FROM_STRING, fmt_1oou1oou, + 0, 0, out, sizeof(out)/sizeof(WCHAR), 5, 3, 1, 4, 2 ); + todo_wine ok(!lstrcmpW( s_sp001002, out),"failed out=[%s]\n", wine_dbgstr_w(out)); + ok(r==11,"failed: r=%d\n",r); + r = doitW(FORMAT_MESSAGE_FROM_STRING, fmt_1oou3oou, + 0, 0, out, sizeof(out)/sizeof(WCHAR), 5, 3, 1, 6, 4, 2 ); + todo_wine ok(!lstrcmpW( s_sp001sp002, out),"failed out=[%s]\n", wine_dbgstr_w(out)); + ok(r==12,"failed: r=%d\n",r); + /* args are not counted the same way with an argument array */ + { + ULONG_PTR args[] = { 6, 4, 2, 5, 3, 1 }; + r = FormatMessageW(FORMAT_MESSAGE_FROM_STRING | FORMAT_MESSAGE_ARGUMENT_ARRAY, fmt_1oou4oou, + 0, 0, out, sizeof(out)/sizeof(WCHAR), (va_list *)args ); + ok(!lstrcmpW(s_sp002sp001, out),"failed out=[%s]\n", wine_dbgstr_w(out)); + ok(r==12,"failed: r=%d\n",r); + } + /* change of pace... test the low byte of dwflags */ /* line feed */ @@ -509,6 +560,41 @@ static void test_message_from_string(void) ok(!strcmp("\r\n\r\n", out),"failed out=[%s]\n",out); ok(r==4,"failed: r=%d\n",r); + /* precision and width */ + + r = doit(FORMAT_MESSAGE_FROM_STRING, "%1!3s!", + 0, 0, out, sizeof(out), "t" ); + ok(!strcmp(" t", out),"failed out=[%s]\n",out); + ok(r==3, "failed: r=%d\n",r); + r = doit(FORMAT_MESSAGE_FROM_STRING, "%1!*s!", + 0, 0, out, sizeof(out), 4, "t"); + ok(!strcmp( " t", out),"failed out=[%s]\n",out); + ok(r==4,"failed: r=%d\n",r); + r = doit(FORMAT_MESSAGE_FROM_STRING, "%1!4.2u!", + 0, 0, out, sizeof(out), 3 ); + ok(!strcmp( " 03", out),"failed out=[%s]\n",out); + ok(r==4,"failed: r=%d\n",r); + r = doit(FORMAT_MESSAGE_FROM_STRING, "%1!*.*u!", + 0, 0, out, sizeof(out), 5, 3, 1 ); + ok(!strcmp( " 001", out),"failed out=[%s]\n",out); + ok(r==5,"failed: r=%d\n",r); + r = doit(FORMAT_MESSAGE_FROM_STRING, "%1!*.*u!,%1!*.*u!", + 0, 0, out, sizeof(out), 5, 3, 1, 4, 2 ); + todo_wine ok(!strcmp( " 001, 0002", out),"failed out=[%s]\n",out); + ok(r==11,"failed: r=%d\n",r); + r = doit(FORMAT_MESSAGE_FROM_STRING, "%1!*.*u!,%3!*.*u!", + 0, 0, out, sizeof(out), 5, 3, 1, 6, 4, 2 ); + todo_wine ok(!strcmp( " 001, 0002", out),"failed out=[%s]\n",out); + ok(r==12,"failed: r=%d\n",r); + /* args are not counted the same way with an argument array */ + { + ULONG_PTR args[] = { 6, 4, 2, 5, 3, 1 }; + r = FormatMessageA(FORMAT_MESSAGE_FROM_STRING | FORMAT_MESSAGE_ARGUMENT_ARRAY, + "%1!*.*u!,%4!*.*u!", 0, 0, out, sizeof(out), (va_list *)args ); + ok(!strcmp(" 0002, 001", out),"failed out=[%s]\n",out); + ok(r==12,"failed: r=%d\n",r); + } + /* change of pace... test the low byte of dwflags */ /* line feed */

1 0

Juan Lang : crypt32: Trace the alt name extensions.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: 1e953ef12ef30510e8387067a795fbc1ce055da3 URL: http://source.winehq.org/git/wine.git/?a=commit;h=1e953ef12ef30510e8387067a… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Oct 23 11:51:40 2009 -0700 crypt32: Trace the alt name extensions. --- dlls/crypt32/chain.c | 101 +++++++++++++++++++++++++++++++------------------ 1 files changed, 64 insertions(+), 37 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index cbbd677..547c74c 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -721,6 +721,61 @@ static void CRYPT_CheckChainNameConstraints(PCERT_SIMPLE_CHAIN chain) } } +static void dump_alt_name_entry(const CERT_ALT_NAME_ENTRY *entry) +{ + switch (entry->dwAltNameChoice) + { + case CERT_ALT_NAME_OTHER_NAME: + TRACE_(chain)("CERT_ALT_NAME_OTHER_NAME, oid = %s\n", + debugstr_a(entry->u.pOtherName->pszObjId)); + break; + case CERT_ALT_NAME_RFC822_NAME: + TRACE_(chain)("CERT_ALT_NAME_RFC822_NAME: %s\n", + debugstr_w(entry->u.pwszRfc822Name)); + break; + case CERT_ALT_NAME_DNS_NAME: + TRACE_(chain)("CERT_ALT_NAME_DNS_NAME: %s\n", + debugstr_w(entry->u.pwszDNSName)); + break; + case CERT_ALT_NAME_DIRECTORY_NAME: + TRACE_(chain)("CERT_ALT_NAME_DIRECTORY_NAME: %d bytes\n", + entry->u.DirectoryName.cbData); + break; + case CERT_ALT_NAME_URL: + TRACE_(chain)("CERT_ALT_NAME_URL: %s\n", debugstr_w(entry->u.pwszURL)); + break; + case CERT_ALT_NAME_IP_ADDRESS: + TRACE_(chain)("CERT_ALT_NAME_IP_ADDRESS: %d bytes\n", + entry->u.IPAddress.cbData); + break; + case CERT_ALT_NAME_REGISTERED_ID: + TRACE_(chain)("CERT_ALT_NAME_REGISTERED_ID: %s\n", + debugstr_a(entry->u.pszRegisteredID)); + break; + default: + TRACE_(chain)("dwAltNameChoice = %d\n", entry->dwAltNameChoice); + } +} + +static void dump_alt_name(LPCSTR type, const CERT_EXTENSION *ext) +{ + CERT_ALT_NAME_INFO *name; + DWORD size; + + TRACE_(chain)("%s:\n", type); + if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ALTERNATE_NAME, + ext->Value.pbData, ext->Value.cbData, + CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL, &name, &size)) + { + DWORD i; + + TRACE_(chain)("%d alt name entries:\n", name->cAltEntry); + for (i = 0; i < name->cAltEntry; i++) + dump_alt_name_entry(&name->rgAltEntry[i]); + LocalFree(name); + } +} + static void dump_basic_constraints(const CERT_EXTENSION *ext) { CERT_BASIC_CONSTRAINTS_INFO *info; @@ -782,42 +837,6 @@ static void dump_key_usage(const CERT_EXTENSION *ext) } } -static void dump_alt_name_entry(const CERT_ALT_NAME_ENTRY *entry) -{ - switch (entry->dwAltNameChoice) - { - case CERT_ALT_NAME_OTHER_NAME: - TRACE_(chain)("CERT_ALT_NAME_OTHER_NAME, oid = %s\n", - debugstr_a(entry->u.pOtherName->pszObjId)); - break; - case CERT_ALT_NAME_RFC822_NAME: - TRACE_(chain)("CERT_ALT_NAME_RFC822_NAME: %s\n", - debugstr_w(entry->u.pwszRfc822Name)); - break; - case CERT_ALT_NAME_DNS_NAME: - TRACE_(chain)("CERT_ALT_NAME_DNS_NAME: %s\n", - debugstr_w(entry->u.pwszDNSName)); - break; - case CERT_ALT_NAME_DIRECTORY_NAME: - TRACE_(chain)("CERT_ALT_NAME_DIRECTORY_NAME: %d bytes\n", - entry->u.DirectoryName.cbData); - break; - case CERT_ALT_NAME_URL: - TRACE_(chain)("CERT_ALT_NAME_URL: %s\n", debugstr_w(entry->u.pwszURL)); - break; - case CERT_ALT_NAME_IP_ADDRESS: - TRACE_(chain)("CERT_ALT_NAME_IP_ADDRESS: %d bytes\n", - entry->u.IPAddress.cbData); - break; - case CERT_ALT_NAME_REGISTERED_ID: - TRACE_(chain)("CERT_ALT_NAME_REGISTERED_ID: %s\n", - debugstr_a(entry->u.pszRegisteredID)); - break; - default: - TRACE_(chain)("dwAltNameChoice = %d\n", entry->dwAltNameChoice); - } -} - static void dump_general_subtree(const CERT_GENERAL_SUBTREE *subtree) { dump_alt_name_entry(&subtree->Base); @@ -898,10 +917,18 @@ static void dump_extension(const CERT_EXTENSION *ext) { TRACE_(chain)("%s (%scritical)\n", debugstr_a(ext->pszObjId), ext->fCritical ? "" : "not "); - if (!strcmp(ext->pszObjId, szOID_BASIC_CONSTRAINTS)) + if (!strcmp(ext->pszObjId, szOID_SUBJECT_ALT_NAME)) + dump_alt_name("subject alt name", ext); + else if (!strcmp(ext->pszObjId, szOID_ISSUER_ALT_NAME)) + dump_alt_name("issuer alt name", ext); + else if (!strcmp(ext->pszObjId, szOID_BASIC_CONSTRAINTS)) dump_basic_constraints(ext); else if (!strcmp(ext->pszObjId, szOID_KEY_USAGE)) dump_key_usage(ext); + else if (!strcmp(ext->pszObjId, szOID_SUBJECT_ALT_NAME2)) + dump_alt_name("subject alt name 2", ext); + else if (!strcmp(ext->pszObjId, szOID_ISSUER_ALT_NAME2)) + dump_alt_name("issuer alt name 2", ext); else if (!strcmp(ext->pszObjId, szOID_BASIC_CONSTRAINTS2)) dump_basic_constraints2(ext); else if (!strcmp(ext->pszObjId, szOID_NAME_CONSTRAINTS))

1 0

Juan Lang : crypt32: Add the Google website's cert to tests.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: 3669be9550048bd7aa35934ebf875d88d651884c URL: http://source.winehq.org/git/wine.git/?a=commit;h=3669be9550048bd7aa35934eb… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Oct 27 15:11:22 2009 -0700 crypt32: Add the Google website's cert to tests. --- dlls/crypt32/tests/chain.c | 135 ++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 135 insertions(+), 0 deletions(-) Diff: http://source.winehq.org/git/wine.git/?a=commitdiff;h=3669be9550048bd7aa359…

1 0

Juan Lang : crypt32: Trace directory name of alt name entries.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: d664edb3221f6a42f9261861addd7582cbb371e0 URL: http://source.winehq.org/git/wine.git/?a=commit;h=d664edb3221f6a42f9261861a… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Oct 23 13:53:26 2009 -0700 crypt32: Trace directory name of alt name entries. --- dlls/crypt32/chain.c | 23 +++++++++++++++++++++-- 1 files changed, 21 insertions(+), 2 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 160bcec..5e09cd7 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -725,8 +725,26 @@ static void CRYPT_CheckChainNameConstraints(PCERT_SIMPLE_CHAIN chain) } } +static LPWSTR name_value_to_str(const CERT_NAME_BLOB *name) +{ + DWORD len = cert_name_to_str_with_indent(X509_ASN_ENCODING, 0, name, + CERT_SIMPLE_NAME_STR, NULL, 0); + LPWSTR str = NULL; + + if (len) + { + str = CryptMemAlloc(len * sizeof(WCHAR)); + if (str) + cert_name_to_str_with_indent(X509_ASN_ENCODING, 0, name, + CERT_SIMPLE_NAME_STR, str, len); + } + return str; +} + static void dump_alt_name_entry(const CERT_ALT_NAME_ENTRY *entry) { + LPWSTR str; + switch (entry->dwAltNameChoice) { case CERT_ALT_NAME_OTHER_NAME: @@ -742,8 +760,9 @@ static void dump_alt_name_entry(const CERT_ALT_NAME_ENTRY *entry) debugstr_w(entry->u.pwszDNSName)); break; case CERT_ALT_NAME_DIRECTORY_NAME: - TRACE_(chain)("CERT_ALT_NAME_DIRECTORY_NAME: %d bytes\n", - entry->u.DirectoryName.cbData); + str = name_value_to_str(&entry->u.DirectoryName); + TRACE_(chain)("CERT_ALT_NAME_DIRECTORY_NAME: %s\n", debugstr_w(str)); + CryptMemFree(str); break; case CERT_ALT_NAME_URL: TRACE_(chain)("CERT_ALT_NAME_URL: %s\n", debugstr_w(entry->u.pwszURL));

1 0

Juan Lang : crypt32: Trace netscape cert type extension.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: bcb4bc6be3ca1b1245dc4e4750179f04f4b9ef26 URL: http://source.winehq.org/git/wine.git/?a=commit;h=bcb4bc6be3ca1b1245dc4e475… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Oct 23 14:11:27 2009 -0700 crypt32: Trace netscape cert type extension. --- dlls/crypt32/chain.c | 28 ++++++++++++++++++++++++++++ 1 files changed, 28 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 5e09cd7..1b26bf3 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -936,6 +936,32 @@ static void dump_enhanced_key_usage(const CERT_EXTENSION *ext) } } +static void dump_netscape_cert_type(const CERT_EXTENSION *ext) +{ + CRYPT_BIT_BLOB usage; + DWORD size = sizeof(usage); + + if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_BITS, ext->Value.pbData, + ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &usage, &size)) + { +#define trace_cert_type_bit(bits, bit) \ + if ((bits) & (bit)) TRACE_(chain)("%s\n", #bit) + if (usage.cbData) + { + trace_cert_type_bit(usage.pbData[0], + NETSCAPE_SSL_CLIENT_AUTH_CERT_TYPE); + trace_cert_type_bit(usage.pbData[0], + NETSCAPE_SSL_SERVER_AUTH_CERT_TYPE); + trace_cert_type_bit(usage.pbData[0], NETSCAPE_SMIME_CERT_TYPE); + trace_cert_type_bit(usage.pbData[0], NETSCAPE_SIGN_CERT_TYPE); + trace_cert_type_bit(usage.pbData[0], NETSCAPE_SSL_CA_CERT_TYPE); + trace_cert_type_bit(usage.pbData[0], NETSCAPE_SMIME_CA_CERT_TYPE); + trace_cert_type_bit(usage.pbData[0], NETSCAPE_SIGN_CA_CERT_TYPE); + } +#undef trace_cert_type_bit + } +} + static void dump_extension(const CERT_EXTENSION *ext) { TRACE_(chain)("%s (%scritical)\n", debugstr_a(ext->pszObjId), @@ -960,6 +986,8 @@ static void dump_extension(const CERT_EXTENSION *ext) dump_cert_policies(ext); else if (!strcmp(ext->pszObjId, szOID_ENHANCED_KEY_USAGE)) dump_enhanced_key_usage(ext); + else if (!strcmp(ext->pszObjId, szOID_NETSCAPE_CERT_TYPE)) + dump_netscape_cert_type(ext); } static LPCWSTR filetime_to_str(const FILETIME *time)

1 0

Juan Lang : crypt32: Support IPv6 addresses in name constraint comparison.
by Alexandre Julliard Oct. 29, 2009

Oct. 29, 2009

Module: wine Branch: master Commit: 24399bd3599101bc8f1600cf0c13a54483662bcc URL: http://source.winehq.org/git/wine.git/?a=commit;h=24399bd3599101bc8f1600cf0… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Oct 23 14:38:47 2009 -0700 crypt32: Support IPv6 addresses in name constraint comparison. --- dlls/crypt32/chain.c | 21 +++++++++++++++++++-- 1 files changed, 19 insertions(+), 2 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 1b26bf3..e8f9de3 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -548,9 +548,13 @@ static BOOL ip_address_matches(const CRYPT_DATA_BLOB *constraint, TRACE("(%d, %p), (%d, %p)\n", constraint->cbData, constraint->pbData, name->cbData, name->pbData); - if (constraint->cbData != sizeof(DWORD) * 2) + /* RFC5280, section 4.2.1.10, iPAddress syntax: either 8 or 32 bytes, for + * IPv4 or IPv6 addresses, respectively. + */ + if (constraint->cbData != sizeof(DWORD) * 2 && constraint->cbData != 32) *trustErrorStatus |= CERT_TRUST_INVALID_NAME_CONSTRAINTS; - else if (name->cbData == sizeof(DWORD)) + else if (name->cbData == sizeof(DWORD) && + constraint->cbData == sizeof(DWORD) * 2) { DWORD subnet, mask, addr; @@ -562,6 +566,19 @@ static BOOL ip_address_matches(const CRYPT_DATA_BLOB *constraint, */ match = (subnet & mask) == (addr & mask); } + else if (name->cbData == 16 && constraint->cbData == 32) + { + const BYTE *subnet, *mask, *addr; + DWORD i; + + subnet = constraint->pbData; + mask = constraint->pbData + 16; + addr = name->pbData; + match = TRUE; + for (i = 0; match && i < 16; i++) + if ((subnet[i] & mask[i]) != (addr[i] & mask[i])) + match = FALSE; + } /* else: name is wrong size, no match */ return match;

1 0